Exponential Platform Legacy v2.5.0.4

A release of the 2.5 line (branch master: Symfony 3.4, platform kernel se7enxweb/ezpublish-kernel ~7.5.33, LegacyBridge 2.1, the Exponential 6 legacy kernel). It corrects front controllers that ran every site in the development environment, and it is the first release that ships the book on installing and running Exponential Platform Legacy.

:::bash
composer create-project se7enxweb/exponential-platform-legacy:~2.5.0.4 my_project

Always give the version: the tag v5.0.3 was cut from this 2.5 line by mistake. Use v5.0.3.1 or later for the 5 line.

Fixes in the code and configuration

• web/.htaccess routes to the production front controller (fa091cd). From v2.5.0.1 to v2.5.0.3 its last rule sent every request to app_dev.php, so every site served through it ran the dev environment with the debug toolbar and full stack traces. Everything that is not a static file now goes to app.php; /app_dev.php/... is let through only by its own name.
• web/app_dev.php answers only the local machine again (d924ceb): requests from 127.0.0.1, ::1 or the PHP built-in server pass; anything else, and anything carrying X-Forwarded-For or Client-IP, gets 403. SYMFONY_DEV_ALLOW_REMOTE=1 opens it on a development server you control.
• web/app.php no longer switches error display on (7605f57); with debugging off it switches display_errors and display_startup_errors off, so errors go to the log only.
• content/treemenu URLs reach the bridge (523606a). web/.htaccess rewrote them to index_treemenu.php, a file the bridge never creates in web/, so they ended in a 404 and the legacy admin's content tree could stay empty. They now reach app.php and the bridge's route _ezpublishLegacyTreeMenu.
• The example doc/apache2/.htaccess is now the same file as web/.htaccess (6ba381b); it still sent every request to app_dev.php.
• The Apache vhost template forbids scripts under var/ again (01e4d59): the rule lacked the leading slash and never matched in a virtual host.
• Platform.sh runs the line on PHP 8.2 instead of 7.3 (b41967c).
• .gitattributes for GitHub's language statistics (8479bb7).

Existing projects: Composer does not update web/.htaccess, web/app.php or web/app_dev.php. Take them from this tag, or apply git show fa091cd d924ceb 7605f57 523606a to your copy, as chapter 13.2 of the book describes.

Documentation

• The book in doc/book/: thirteen chapters on all four release lines (2.5, 3.3, 4.6, 5), from requirements, getting the code and installing, the legacy kernel inside the platform, serving the site (Exponential Velocity, Apache, nginx, Varnish, Docker, Platform.sh), databases, configuration in YAML and INI, operations, upgrading between lines and migrating in, to troubleshooting and security hardening with a go-live checklist. Every chapter was checked against the code of each line. The same book is on the 3.x, 4.6.x and 5.x branches; the copy on master is the newest.
• doc/INSTALL.md is now a short installation guide for the 2.5 line with links into the book (73fc2be, b7545a8).
• The README names versions, commands and addresses that exist on this line, lists the documentation and names the security address (1badb23, ea5ddb6, 1c85a78, d4d00bb); UPGRADE.md points to the book instead of dead links (d9408f0, 6b9d1a9); the upstream README says that it is historical (ee5a297).
• SECURITY.md names the four maintained release lines and one reporting address, security@se7enx.com (9c69af7).
• The book records the fixes on all four branches and which tags still carry the old behaviour (9d6092c).

Full list of changes: https://github.com/se7enxweb/exponential-platform-legacy/compare/v2.5.0.3...v2.5.0.4